wudi · pull · Mar 11, 2025 · Mar 11, 2025 · Mar 11, 2025 · Mar 11, 2025
diff --git a/NEWS b/NEWS
@@ -150,6 +150,7 @@ PHP                                                                        NEWS
   . socket_getsockname/socket_create/socket_bind handled AF_PACKET family socket.
     (David Carlier)
   . Added IP_BINDANY for a socket to bind to any address. (David Carlier)
+  . Added SO_BUSY_POOL to reduce packets poll latency. (David Carlier)
 
 - Sodium:
   . Fix overall theorical overflows on zend_string buffer allocations.

diff --git a/UPGRADING b/UPGRADING
@@ -308,6 +308,7 @@ PHP 8.5 UPGRADE NOTES
   . TCP_BBR_ALGORITHM (FreeBSD only).
   . AF_PACKET (Linux only).
   . IP_BINDANY (FreeBSD/NetBSD/OpenBSD only).
+  . SO_BUSY_POLL (Linux only).
 
 ========================================
 11. Changes to INI File Handling

diff --git a/Zend/tests/ghsa-rwp7-7vc6-8477_001.phpt b/Zend/tests/ghsa-rwp7-7vc6-8477_001.phpt
@@ -0,0 +1,26 @@
+--TEST--
+GHSA-rwp7-7vc6-8477: Use-after-free for ??= due to incorrect live-range calculation
+--FILE--
+<?php
+
+class Foo {
+    public function foo() {
+        return $this;
+    }
+
+    public function __set($name, $value) {
+        throw new Exception('Hello');
+    }
+}
+
+$foo = new Foo();
+
+try {
+    $foo->foo()->baz ??= 1;
+} catch (Exception $e) {
+    echo $e->getMessage();
+}
+
+?>
+--EXPECT--
+Hello
diff --git a/Zend/tests/ghsa-rwp7-7vc6-8477_002.phpt b/Zend/tests/ghsa-rwp7-7vc6-8477_002.phpt
@@ -0,0 +1,24 @@
+--TEST--
+GHSA-rwp7-7vc6-8477: Use-after-free for ??= due to incorrect live-range calculation
+--FILE--
+<?php
+
+class Foo {
+    public int $prop;
+
+    public function foo() {
+        return $this;
+    }
+}
+
+$foo = new Foo();
+
+try {
+    $foo->foo()->prop ??= 'foo';
+} catch (Error $e) {
+    echo $e->getMessage();
+}
+
+?>
+--EXPECT--
+Cannot assign string to property Foo::$prop of type int
diff --git a/Zend/tests/ghsa-rwp7-7vc6-8477_003.phpt b/Zend/tests/ghsa-rwp7-7vc6-8477_003.phpt
@@ -0,0 +1,22 @@
+--TEST--
+GHSA-rwp7-7vc6-8477: Use-after-free for ??= due to incorrect live-range calculation
+--FILE--
+<?php
+
+class Foo {
+    public int $prop;
+}
+
+function newFoo() {
+    return new Foo();
+}
+
+try {
+    newFoo()->prop ??= 'foo';
+} catch (Error $e) {
+    echo $e->getMessage();
+}
+
+?>
+--EXPECT--
+Cannot assign string to property Foo::$prop of type int
diff --git a/Zend/zend_opcode.c b/Zend/zend_opcode.c
@@ -940,6 +940,14 @@ static void zend_calc_live_ranges(
 		opnum--;
 		opline--;
 
+		/* SEPARATE always redeclares its op1. For the purposes of live-ranges,
+		 * its declaration is irrelevant. Don't terminate the current live-range
+		 * to avoid breaking special handling of COPY_TMP. */
+		if (opline->opcode == ZEND_SEPARATE) {
+			ZEND_ASSERT(opline->op1.var == opline->result.var);
+			continue;
+		}
+
 		if ((opline->result_type & (IS_TMP_VAR|IS_VAR)) && !is_fake_def(opline)) {
 			uint32_t var_num = EX_VAR_TO_NUM(opline->result.var) - var_offset;
 			/* Defs without uses can occur for two reasons: Either because the result is

diff --git a/ext/dom/tests/ghsa-p3x9-6h7p-cgfc_001.phpt b/ext/dom/tests/ghsa-p3x9-6h7p-cgfc_001.phpt
@@ -0,0 +1,60 @@
+--TEST--
+GHSA-p3x9-6h7p-cgfc: libxml streams use wrong `content-type` header when requesting a redirected resource (Basic)
+--EXTENSIONS--
+dom
+--SKIPIF--
+<?php
+if (@!include "./ext/standard/tests/http/server.inc") die('skip server.inc not available');
+http_server_skipif();
+?>
+--FILE--
+<?php
+require "./ext/standard/tests/http/server.inc";
+
+function genResponses($server) {
+    $uri = 'http://' . stream_socket_get_name($server, false);
+    yield "data://text/plain,HTTP/1.1 302 Moved Temporarily\r\nLocation: $uri/document.xml\r\nContent-Type: text/html;charset=utf-16\r\n\r\n";
+    $xml = <<<'EOT'
+        <!doctype html>
+        <html>
+            <head>
+                <title>GHSA-p3x9-6h7p-cgfc</title>
+
+                <meta charset="utf-8" />
+                <meta http-equiv="Content-type" content="text/html; charset=utf-8" />
+            </head>
+
+            <body>
+                <h1>GHSA-p3x9-6h7p-cgfc</h1>
+            </body>
+        </html>
+        EOT;
+    // Intentionally using non-standard casing for content-type to verify it is matched not case sensitively.
+    yield "data://text/plain,HTTP/1.1 200 OK\r\nconteNt-tyPe: text/html; charset=utf-8\r\n\r\n{$xml}";
+}
+
+['pid' => $pid, 'uri' => $uri] = http_server('genResponses', $output);
+$document = new \DOMDocument();
+$document->loadHTMLFile($uri);
+
+$h1 = $document->getElementsByTagName('h1');
+var_dump($h1->length);
+var_dump($document->saveHTML());
+http_server_kill($pid);
+?>
+--EXPECT--
+int(1)
+string(266) "<!DOCTYPE html>
+<html>
+    <head>
+        <title>GHSA-p3x9-6h7p-cgfc</title>
+
+        <meta charset="utf-8">
+        <meta http-equiv="Content-type" content="text/html; charset=utf-8">
+    </head>
+
+    <body>
+        <h1>GHSA-p3x9-6h7p-cgfc</h1>
+    </body>
+</html>
+"
diff --git a/ext/dom/tests/ghsa-p3x9-6h7p-cgfc_002.phpt b/ext/dom/tests/ghsa-p3x9-6h7p-cgfc_002.phpt
@@ -0,0 +1,60 @@
+--TEST--
+GHSA-p3x9-6h7p-cgfc: libxml streams use wrong `content-type` header when requesting a redirected resource (Missing content-type)
+--EXTENSIONS--
+dom
+--SKIPIF--
+<?php
+if (@!include "./ext/standard/tests/http/server.inc") die('skip server.inc not available');
+http_server_skipif();
+?>
+--FILE--
+<?php
+require "./ext/standard/tests/http/server.inc";
+
+function genResponses($server) {
+    $uri = 'http://' . stream_socket_get_name($server, false);
+    yield "data://text/plain,HTTP/1.1 302 Moved Temporarily\r\nLocation: $uri/document.xml\r\nContent-Type: text/html;charset=utf-16\r\n\r\n";
+    $xml = <<<'EOT'
+        <!doctype html>
+        <html>
+            <head>
+                <title>GHSA-p3x9-6h7p-cgfc</title>
+
+                <meta charset="utf-8" />
+                <meta http-equiv="Content-type" content="text/html; charset=utf-8" />
+            </head>
+
+            <body>
+                <h1>GHSA-p3x9-6h7p-cgfc</h1>
+            </body>
+        </html>
+        EOT;
+    // Missing content-type in actual response.
+    yield "data://text/plain,HTTP/1.1 200 OK\r\n\r\n{$xml}";
+}
+
+['pid' => $pid, 'uri' => $uri] = http_server('genResponses', $output);
+$document = new \DOMDocument();
+$document->loadHTMLFile($uri);
+
+$h1 = $document->getElementsByTagName('h1');
+var_dump($h1->length);
+var_dump($document->saveHTML());
+http_server_kill($pid);
+?>
+--EXPECT--
+int(1)
+string(266) "<!DOCTYPE html>
+<html>
+    <head>
+        <title>GHSA-p3x9-6h7p-cgfc</title>
+
+        <meta charset="utf-8">
+        <meta http-equiv="Content-type" content="text/html; charset=utf-8">
+    </head>
+
+    <body>
+        <h1>GHSA-p3x9-6h7p-cgfc</h1>
+    </body>
+</html>
+"
diff --git a/ext/dom/tests/ghsa-p3x9-6h7p-cgfc_003.phpt b/ext/dom/tests/ghsa-p3x9-6h7p-cgfc_003.phpt
@@ -0,0 +1,60 @@
+--TEST--
+GHSA-p3x9-6h7p-cgfc: libxml streams use wrong `content-type` header when requesting a redirected resource (Reason with colon)
+--EXTENSIONS--
+dom
+--SKIPIF--
+<?php
+if (@!include "./ext/standard/tests/http/server.inc") die('skip server.inc not available');
+http_server_skipif();
+?>
+--FILE--
+<?php
+require "./ext/standard/tests/http/server.inc";
+
+function genResponses($server) {
+    $uri = 'http://' . stream_socket_get_name($server, false);
+    yield "data://text/plain,HTTP/1.1 302 Moved Temporarily\r\nLocation: $uri/document.xml\r\nContent-Type: text/html;charset=utf-16\r\n\r\n";
+    $xml = <<<'EOT'
+        <!doctype html>
+        <html>
+            <head>
+                <title>GHSA-p3x9-6h7p-cgfc</title>
+
+                <meta charset="utf-8" />
+                <meta http-equiv="Content-type" content="text/html; charset=utf-8" />
+            </head>
+
+            <body>
+                <h1>GHSA-p3x9-6h7p-cgfc</h1>
+            </body>
+        </html>
+        EOT;
+    // Missing content-type in actual response.
+    yield "data://text/plain,HTTP/1.1 200 OK: This is fine\r\n\r\n{$xml}";
+}
+
+['pid' => $pid, 'uri' => $uri] = http_server('genResponses', $output);
+$document = new \DOMDocument();
+$document->loadHTMLFile($uri);
+
+$h1 = $document->getElementsByTagName('h1');
+var_dump($h1->length);
+var_dump($document->saveHTML());
+http_server_kill($pid);
+?>
+--EXPECT--
+int(1)
+string(266) "<!DOCTYPE html>
+<html>
+    <head>
+        <title>GHSA-p3x9-6h7p-cgfc</title>
+
+        <meta charset="utf-8">
+        <meta http-equiv="Content-type" content="text/html; charset=utf-8">
+    </head>
+
+    <body>
+        <h1>GHSA-p3x9-6h7p-cgfc</h1>
+    </body>
+</html>
+"
diff --git a/ext/libxml/mime_sniff.c b/ext/libxml/mime_sniff.c
@@ -308,11 +308,21 @@ PHP_LIBXML_API zend_string *php_libxml_sniff_charset_from_stream(const php_strea
 	if (Z_TYPE(s->wrapperdata) == IS_ARRAY) {
 		zval *header;
 
-		ZEND_HASH_FOREACH_VAL_IND(Z_ARRVAL(s->wrapperdata), header) {
-			const char buf[] = "Content-Type:";
-			if (Z_TYPE_P(header) == IS_STRING &&
-					!zend_binary_strncasecmp(Z_STRVAL_P(header), Z_STRLEN_P(header), buf, sizeof(buf)-1, sizeof(buf)-1)) {
-				return php_libxml_sniff_charset_from_string(Z_STRVAL_P(header) + sizeof(buf) - 1, Z_STRVAL_P(header) + Z_STRLEN_P(header));
+		/* Scan backwards: The header array might contain the headers for multiple responses, if
+		 * a redirect was followed.
+		 */
+		ZEND_HASH_REVERSE_FOREACH_VAL_IND(Z_ARRVAL(s->wrapperdata), header) {
+			if (Z_TYPE_P(header) == IS_STRING) {
+				/* If no colon is found in the header, we assume it's the HTTP status line and bail out. */
+				char *colon = memchr(Z_STRVAL_P(header), ':', Z_STRLEN_P(header));
+				char *space = memchr(Z_STRVAL_P(header), ' ', Z_STRLEN_P(header));
+				if (colon == NULL || space < colon) {
+					return NULL;
+				}
+
+				if (zend_string_starts_with_literal_ci(Z_STR_P(header), "content-type:")) {
+					return php_libxml_sniff_charset_from_string(Z_STRVAL_P(header) + strlen("content-type:"), Z_STRVAL_P(header) + Z_STRLEN_P(header));
+				}
 			}
 		} ZEND_HASH_FOREACH_END();
 	}

diff --git a/ext/sockets/sockets.stub.php b/ext/sockets/sockets.stub.php
@@ -454,6 +454,13 @@
  */
 const SO_EXCLBIND = UNKNOWN;
 #endif
+#ifdef SO_BUSY_POLL
+/**
+ * @var int
+ * @cvalue SO_BUSY_POLL
+ */
+const SO_BUSY_POLL = UNKNOWN;
+#endif
 #ifdef SKF_AD_OFF
 /**
  * @var int

diff --git a/ext/sockets/sockets_arginfo.h b/ext/sockets/sockets_arginfo.h